Contents From The End of a File Using Tail

Viewing the beginning of a file is all well and good, but that’s not where most of the action is.

The end of file can be more interesting, especially if it keeps changing, as is the case with log files.

usage: tail [-F | -f | -r] [-q] [-b # | -c # | -n #] [file ...]

This article makes use of a collection of random files. These files were put together to help you “Tweak Your Terminal”. Checkout our guide to setting up the random files.

Tail has all the options as head, as well as a few more.

By number of lines

Return a specified number of lines, or 10 by default, from the end of the file.

tail -n 1 decamerone.txt
procuratori è, una noia che, gli intendo cose le esperienza di porgiamo;

By number of bytes

Return a certain number of characters from the end of the file.

tail -c 20 decamerone.txt
rienza di porgiamo;

By number of blocks

You also return the last specified number of 512 byte blocks.

tail -b 1 decamerone.txt
evole nome Cepperello ci noi non che, e temporali reputiamo
cosa chiamato nome medesimi, di fatica non fa, dovendo a i d’esse, a così i
dallo reputato per mentre è sono da sono sua niuno io da coloro stato
d’angoscia prestasse! Siamo, frate, etterni quale la durare e sì prieghi di
La ma fu noi benignità mescolati parte discenda, in in quali transitorie suo
Ser fermi avvedimento incominciare, cosa e sue con mossa morto pessimo
procuratori è, una noia che, gli intendo cose le esperienza di porgiamo;

Note: historically your hard drive was divided into blocks that were 512 bytes in size.
With APFS (Apple File System) the block size is 4096 bytes.

Follow File Output

You can also use tail to follow the output of a file with the -f option.  This is will show you the specified amount of text, but then also show new text as it gets appended to the file.  A good use case for this is examining log files.

tail -n 3 -f /var/log/system.log
Nov 19 11:34:19 MacBook-Pro News[23955]: CDN - client setup_local_port
Nov 19 11:34:19 MacBook-Pro News[23955]: CDN - Local Port: 117519
Nov 19 11:37:30 MacBook-Pro syslogd[90]: ASL Sender Statistics

The tail command will hang and keep adding new lines as they appear in the file.
When you have finished, you can press ^C (control + c) to exit from tail.

macOS will try to stop a single log file becoming to big, by rotating the files daily.

ls -lath /var/log/system.log*
-rw-r-----@ 1 root  admin    52K 19 Nov 11:41 /var/log/system.log
-rw-r-----  1 root  admin   3.6K 19 Nov 00:40 /var/log/system.log.0.gz
-rw-r-----  1 root  admin   6.0K 18 Nov 00:25 /var/log/system.log.1.gz
-rw-r-----  1 root  admin    15K 17 Nov 01:24 /var/log/system.log.2.gz

Follow Renamed or Rotated Files

If you are using tail with the -f option whilst this happens, then tail will suddenly not be able to read the file any more.  It will have been compressed and then deleted.

The -F option will detect this, and carry on as normal.

Follow More Files At Once

Occasionally, when I am debugging a server, I will want to see all the log file changes as they come in.  When you are doing this, you don’t want to open up a new tab for every file.

The good news is you can get tail to monitor all the files at the same time.

Everytime there is new output, tail will repeat log file name and then print the new line.

tail -n 1 -f /var/log/*.log

==> /var/log/system.log <==

Nov 19 11:47:36 MacBook-Pro syslogd[90]: ASL Sender Statistics

==> /var/log/wifi-11-16-2019__15:07:12.223.log <==

Sat Nov 16 15:07:12.223 Driver Event: <airportd[233]> _bsd_80211_event_callback: DUMP_LOGS (en0)

==> /var/log/system.log <==

Nov 19 11:49:20 MacBook-Pro News[24043]: CDN - client insert callback function client = 0 type = 17 function = 0x7fff3a3fa21e local_olny = false